UNCLASSIFIED / FOR OFFICIAL USE ONLY

!"##$%# !"'(%")* +"#,-'," .'!! ',,'/0

12334$2$ 56789:;<
$=>:?67 @AB @CDE
F#"/GCEGCCCCCG#,G0#G@CDC
(U) This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO). It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accord-
ance with KIFC policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know without prior approv-
al of the Kansas Intelligence Fusion Center. Federal, State and local homeland security officials may share this document with authorized critical infrastructure and key resource
personnel and private sector security officials without further approval from the Kansas Intelligence Fusion Center.
UNCLASSFED/FOR OFFCAL USE ONLY



KANSAS INTELLIGENCE FUSION CENTER
UNCLASSIFIED / FOR OFFICIAL USE ONLY
2

(U//FOUO) Execuve Summary
On Saturday, September 21, 2013, members of Al Shabaab, a Somali based Islamic
terrorist organizaon aliated with the internaonal Al Qaeda network, executed
a complex terrorist aack on an upscale shopping mall in Nairobi, Kenya. The
aackers simultaneously entered the mall from two dierent entrances, shoong
shoppers with assault ries and throwing hand grenades. The terrorists remained
in the mall, engaging government security forces for the next four days, resulng in
a major re and paral collapse of the mall. The Kenyan government has ocially
reported 72 deaths and more than 200 injured as a result of the aack. A signi-
cant number of those killed and injured were foreign cizens, including 6 U.S. ci-
zens who were injured in the aack.
This product is intended to provide an overview of the aack and its aermath for
government leaders, law enforcement ocers, emergency responders and private
sector partners who operate public venues, including shopping malls so that they
can review their facilies, security measures and plans in the face of the taccs
used by Al Shabaab.

(U) Abdul Haji reaches out to 4 year old Pora Walton during the inial
stage of the Westgate Mall aack on September 21, 2013
(1)

What is Al Shabaab?
Al"Shabab " meaning "The Youth" in Arabic " are the largest group among several armed Somali groups and clans that aim to topple Somalia's
government and impose Islamic law. The group was formerly the military wing of the deposed Islamic Court Union (ICU) " which controlled much
of central and southern Somalia in late 2006.
Al"Shabab, which announced its aliaon with Al"Qaeda in 2012, is regarded by the U.S. and many other governments as a terrorist organizaon.
The FBI has expressed concern that the group may be expanding its reach and acvely recruing western naonals to ght in Somalia.
Under the direcon of Emir Mukhtar Abu Zubayr, Al"Shabaab has been transformed from an insurgent ouit focused on Somalia into a terrorist
group capable of devastang aacks beyond its borders, including the suicide bombings against bars in Uganda's capital Kampala in 2010, and
September's Westgate mall siege in Nairobi, Kenya.
(2) (3)

UNCLASSIFIED / FOR OFFICIAL USE ONLY
3

(U//FOUO) Summary of Lessons Learned
The level of planning and the magnitude of the aack indicate that Al Qaeda in general and Al
Shabaab in parcular remain a serious threat.
The fact that all the preparaon for this aack, from gathering intelligence on the target, to
training, equipping and moving the terrorists to their target, was done in secrecy demonstrates
a sophiscated knowledge of operaonal security and communicaon security measures.
Acve shooter scenarios connue to be a viable threat to public venues and need to be ad-
dressed by both law enforcement agencies and private security.
The aack may have been carried out by as few as four terrorists, despite early reports that
ten to een aackers took part.
During an aack of this type, there is no intent by the aackers to take hostages or negoate
with law enforcement. The longer the aackers remain operaonal, the more vicms will be
killed or injured in the aack.
Rapid inial response by available law enforcement and security forces, even if disorganized,
saves lives during the inial phase of an acve shooter aack.


UNCLASSIFIED / FOR OFFICIAL USE ONLY
4

(U//FOUO) Summary of Lessons Learned
Asymmetric, hit and run, taccs by a small number of terrorists are eecve against law en-
forcement ocers entering and clearing a large public venue. Aackers who have advanced,
detailed knowledge of a facility can use that knowledge to ambush and ank security forces,
eecvely engaging (and in some cases, pinning down) a far larger group of ocers.
First responders to an aack of this type must consider the possibility of advanced taccs,
ambushes targeted on rst responders, supporng sniper re and the possibility of remotely
controlled improvised explosive devices emplaced near command posts or staging areas.
Command and control measures are essenal, including use of the incident command system,
accountability for all personnel at the scene, planning for operaons, and establishment of in-
teroperable communicaons between all responders.
Community leaders, responding agencies and owners of public venues must have a plan in
place before an incident to cooperate in providing mely, consistent and accurate informaon
to the public during an emergency.
The United States has seen a number of extremists travel to Somalia and surrounding countries
to train and ght with Al Shabaab. However, at some point it is possible that these experi-
enced ghters, with a knowledge of our country, will return to aack within our borders.

UNCLASSIFIED / FOR OFFICIAL USE ONLY
5

(U) Background

Westgate Mall
(photo at right) (10)

The Westgate Mall is an upscale shopping mall located in the Westlands neigh-
borhood of Nairobi, Kenya. The ve"story mall opened in 2007 and includes
350,000 square feet of retail space and houses more than 80 stores. Nakuma
(a large, mul"story grocery and department store) and Planet Media Cinemas
are the primary anchors of the mall. Other large businesses include Identy,
Mr. Price Home, Artcae, and Barclays Bank on the ground oor, and Million-
aires Casino on the third oor. Smaller stores include outlets for internaonal
brands such as Adidas, Bata Shoes, CFC Stanbic Bank, Converse, FedEx, and
Samsung Mobile.
(7)

Threat Stream
Due to its high prole clientele and western businesses, the Westgate Mall had
been the subject of numerous threats since its opening. The Kenya Naonal
Intelligence Service (NIS) reported Al Shabaab was planning aacks in Nairobi
and specically listed the Westgate Mall as one of the targets that had been
considered.
(25)

Mall Security
The mall employed approximately 40 private security guards who manned en-
trances and searched vehicles before they were permied into the shopping
center garages. Mall guards searched bags, used electronic wands to search
for weapons and checked vehicle interiors, trunks and underneath to check for
weapons and bombs.
(8)(9)

(U) PHOTO: Inside the Nukuma Supermarket prior to the aack
UNCLASSIFIED / FOR OFFICIAL USE ONLY
6

(U) Westgate Mall Layout

(U) Mul"story Nukuma Supermarket and Department
Store located under the rooop parking garage (area of col-
lapse)
(26)

Central atrium of the Westgate Mall before the aack
(11)

(12)
UNCLASSIFIED / FOR OFFICIAL USE ONLY
7

(U) Background

Nairobi
Nairobi is the largest city (populaon 3.1 million) and capitol of the east African naon of Kenya.
Kenya was a Brish Colony unl it gained its independence in 1963 and remains heavily western-
ized. It has become one of the most prominent cies in Africa both polically and nancially. Nairo-
bi is home to over 100 major internaonal companies and organizaons, including the United Na-
ons Environment Program (UNEP) and the main headquarters for the UN in Africa & Middle East.
(4)

Kenyan defense forces take part in the African Union Mission in Somalia (AMISOM), a peacekeeping
mission operated in Somalia by the African Union with the approval of the United Naons. It sup-
ports the transional government, implements a naonal security plan, trains the Somali govern-
ment security forces, and assists in creang a secure environment for the delivery of humanitarian
aid. As part of its dues, AMISOM also supports the Federal Government of Somalia's forces in their
bale against Al"Shabaab militants.
(5)
Kenya Law Enforcement and Internal Security
Law enforcement is provided by the naonal Kenya Police force, made up of approximately 35,000
ocers. Within the Kenya Police, internal security and counter"terrorism is the role of the General
Services Unit (GSU) that was established by the colonial government to bale Mau Mau rebels dur-
ing the ght for Kenya's independence. The GSU now has around 9,000 paramilitary ocers of
which 2,000 are Israeli trained and bale hardened (Recce group) that forms most of the Presiden-
al guard, VIP and Diplomac protecon.
(6)

(U) PHOTO AT RIGHT : Members of the Kenya Police General Services Unit (GSU)

UNCLASSIFIED / FOR OFFICIAL USE ONLY
8

(U) DAY 1 Saturday, September 21, 2013

Inial Aack
At the me of the aack, the Westgate Mall was crowded with an esmated 800 to 1000
shoppers, a normal Saturday. On the Malls upper parking deck, a lm crew was recording
MasterChef Junior and the play area's bouncy castle and trampolines were packed with
dozens of children.
(12) (13)

Around 12:30, Closed circuit television (CCTV) footage taken by security cameras inside
the mall indicate that two terrorists entered through the main entrance to the mall while
two others made their way up a ramp to the rear parking deck. The aackers were inial-
ly reported to be armed with pistols, fully automac AK"47 assault ries and hand gre-
nades, which they reportedly threw with impunity at vicms.
During the inial aack and throughout the siege, Kenyan authories repeatedly stated
that there were 10 to 15 aackers in the Westgate Mall. However, at the me that this is
wrien, review of the CCTV footage, recovered bodies and weapons indicate that only
four terrorists took part in the aack. In addion, despite claims during the aack that
one of the terrorists was a Caucasian female, all evidence now shows that all the aack-
ers were dark skin adult males.
(15) (24) (26) (28)

Mall patrons and employees took cover around the mall and hid from the aackers inside
stores, stairwells, air vents and beneath tables. Despite news reports, the terrorists made
no aempts to take hostages during the aack.
(28)

On more than one occasion, vicms reported that the aackers asked cornered vicms if
they were Muslims, asking quesons such as the name of Mohammeds mother or de-
manding that they quote from the Koran. Witnesses report that terrorists allowed those
who were Muslim to leave the mall, those who were not were shot. CCTV footage con-
rms these reports, showing instances of terrorists ushering people out of the mall and
others where terrorists appear to queson individuals and then execute them.
(13) (14) (28)






(U) Photo above" Aermath of the aack at the cooking compe-
on on the rooop parking lot.
(U) Photo above An image of two of the terrorists caught on
closed circuit security cameras shortly aer the beginning of the
aack.
UNCLASSIFIED / FOR OFFICIAL USE ONLY
9

(U) DAY 1 Saturday, September 21, 2013

Al Shabaab Claims Responsibility
The Somalia"based Al"Shabaab terror group claimed responsibility for
the aack as retaliaon for Kenyas involvement in an African Union
military eort against the group, which is al Qaedas proxy in Somalia.
In 2011, the Kenyan military was part of a peacekeeping force that
defeated al"Shabaab forces to liberate the key Somali port of Kis-
mayo.
Inial Response
Inially, the response to the terrorists consisted of an ad"hoc group of
local police, armed security guards, armed local cizens and o"duty
members of the police and military who had been in side the mall
when the aack took place. While this response was very unor-
ganized, it is credited with saving many people by providing them
with a safe way to evacuate from the mall.
(1) (12)
The terrorists are reported to have an inmate knowledge of the
mall. Government forces report that they appear to have hidden
caches of ammunion and explosives inside the mall prior to the
aack.
(12)

Approximately 3 1/2 hours aer the aack began, elements of the
General Services Unit (GSU) Recce Company" Kenyas primary inter-
nal an"terrorism response force, arrived at the Westgate Mall. GSU
Ocers reportedly engaged the terrorists in a reght and pinned
them down inside the Nukuma Store.
(26)






(U) Photo " Inial responders evacuate employees and shoppers from the Westgate
Mall.
(U) Some of the Al Shabaab Ocial Twier messages sent during the rst day of the
Westgate Aack. Al Shabaab connually sent messages during the aack claiming
responsibility, praising the aackers and claiming more aacks are to come.
(29)

UNCLASSIFIED / FOR OFFICIAL USE ONLY
10

(U) DAY 1 Saturday, September 21, 2013

Friendly Fire
Members of the Kenyan Army Ranger Regiment also began to arrive and en-
ter the Mall. There apparently was no aempt at communicaon or coordi-
naon between the police forces and the military forces that responded. Re-
sponding soldiers and police ocers were equipped with incompable radio
systems, so they could not communicate taccally.
These factors are blamed for the friendly re situaon between Rangers
and police early Saturday evening that claimed the life of one of the GSU
Recce Company Commanders and wounded three other GSU ocers. For
the remainder of the aack, the response was fractured and conicng infor-
maon was released to the media from dierent elements of the Kenyan
government.
(12) (16) (27) (28)
Forces pull back overnight
As evening approached, the government forces, cing a lack of night vision
gear, withdrew from the mall into perimeter posions. Overnight, survivors
report that the terrorists walked through the mall, idened themselves as
police helping with the evacuaon and then executed anyone who revealed
themselves.
Foreign Fighter Connecon?
Early on September 22nd, a social media Tweet that allegedly came from Al Sha-
baab idened ten men , including three American cizens, that they idened as
taking part in the aack at the Westgate Shopping Center. One of the individuals
was reportedly from the Kansas City area. However, Al Shabaab ocials later stat-
ed that the informaon provided and the social media account that sent the infor-
maon were false.
(12) (13) (20)





(U) PHOTO A woman and children take cover during the aack.
(U) PHOTO" A wounded woman is loaded into an ambulance outside the
Westgate Mall in the early hours of the aack.
UNCLASSIFIED / FOR OFFICIAL USE ONLY
11

(U) DAY 2 Sunday, September 22, 2013

Assault Aempt
Under the command of the police chief, a joint unit comprised of police and army
made a rst aempt to enter and take control of the ground oor of Nakuma,
where they believed the bulk of the militants were. They came under re from a
sniper on one of the upper oors and were forced to withdraw aer at least two
of their men were shot, one of them fatally.
Cizens connued to hide inside the mall and communicate with loved ones and
government forces via cellular phones. Social media sites, such as Twier, were
used throughout the siege by vicms trapped inside, members of the military
seeking informaon and Al Shabaab leadership.
(18) (29)
Hit and run bales between terrorists and military forces connue throughout the
day. Wounded soldiers were seen being removed from the mall. Helicopters
landed on the roof, disgorging troops in an apparent aempt to assault the mall
from the top down.
By late night on Sunday, the Kenyan military claimed that most hostages had
been rescued and that the mall was largely secured.
(12) (18) (19) (26)

(U) PHOTO " A Kenyan soldier moves through the Nukuma Store.
(U) PHOTO " A diagram quickly sketched by a soldier shows the interior of
the mall during the siege.
(12)

(U) PHOTO AT RIGHT " Through-
out the day on Sunday, survi-
vors who were hiding in the
mall (including in air ducts and
vaults) were evacuated from
UNCLASSIFIED / FOR OFFICIAL USE ONLY
12

(U) DAY 3 Monday, September 23, 2013

Explosions and Fire
Around 6:45 AM, a huge blast shook the enre Westlands district, followed by bursts of gun-
re. Around 1 PM, four more large blasts the loudest during the siege were heard from
inside Westgate and a column of black smoke climbed into the sky. (photo at le)
Ocials reported that there was a large re burning inside the Nukuma Store. Some gov-
ernment ocials claimed that terrorists started the blaze but others indicate that the re
may have been started by government forces ring ant"tank weapons inside the mall.
(21)
Belt Fed Machine Guns
Government forces report that the terrorists have somehow moved belt"fed, heavy machine
guns into the mall and that they have been connually pinned down by heavy re. In addi-
on, they report that the aackers have planted remote detonated explosives around the
mall that they are blowing up as security forces move in.
(22)

Around 3 PM, due to heavy smoke, military forces pull out of the mall.
At this point, more than 200 civilians have been rescued and 11 Kenyan soldiers have been
wounded, the military said.
(19) (20)

(U) Photo " Military forces staging outside the Westgate Mall.
(U) Examples of an Al Shabaab Ocial Twier message sent during the West-
gate Aack. Al Shabaab connually sent messages during the aack claiming
responsibility, praising the aackers and claiming more aacks are to come.
(29)

UNCLASSIFIED / FOR OFFICIAL USE ONLY
13

(U) DAY 4 Tuesday, September 24, 2013

Collapse and Mop Up
Government forces report that the ongoing explosions and gunre inside the mall are
coming from troops providing cover while bomb disposal teams remove booby traps
from the mall.
The rst photos of the area where the concrete parking structure has collapsed down
through the three oors below it are shown by the media.
(21)

Tuesday evening, the Kenyan government nally announces that the building has been
secured and that they will begin an invesgaon. They report that there are approxi-
mately 60 persons sll missing and that bodies may be buried in the rubble of the col-
lapsed Nukuma Store.
(12) (13) (16)
Torture & Mulaon
Military doctors reported to the media that the terrorists apparently tortured some of
the vicms they found in the mall. The terrorists reportedly severed hands, cut o nos-
es and, in some cases, hanged hostages. Photographs of tortured and mulated corps-
es were shared with the media to support those claims.
(25)

Following the aack, government forces were accused of widespread loong of the
mall throughout the aack. Commanders deny the accusaons, however security cam-
era footage clearly shows troops loong the mall during the aack.
(23) (28)

The Westgate Mall aack was the deadliest terror aack in Kenya since Al Qaeda blew
up the U.S. Embassy there in 1998, killing 213 people. Terrorism experts say this
aack bears eerie similaries to the 2008 aack in Mumbai, India "" another upscale
target with Western appeal. Lashkar"e"Taiba, a Pakistani terrorist group, aacked tar-
gets in Mumbai for more than three days, killing 166 people.
(25)


(U) Photo " Collapse of the parking deck through the Nukuma Store.
(U) Photo " Collapse of the parking deck through the Nukuma Store.
UNCLASSIFIED / FOR OFFICIAL USE ONLY
14

(U) Sources

(1) Taylor, Adam. "There's A Remarkable Story Behind This Striking Photo From The Westgate Mall Aack." Business Insider. N.p., 27 Sept. 2013. Web. 14 Oct. 2013.
(2) Lister, Tim. "Ruthless Leader Aims to Extend Reach of Al"Shabaab, Eyes the West." CNN. Cable News Network, Web. 14 Oct. 2013.
(3) "Who Are Al"Shabab? " Africa " Al Jazeera English." Al Jazeera English. N.p., 31 Oct. 2011. Web. 14 Oct. 2013
(4) Bauck, Haver. "Nairobi City Guide: The Green City In The Sun." Hvar Bauck RSS. N.p., n.d. Web. 14 Oct. 2013
(5) "S"RES"1772(2007) Security Council Resoluon 1772 (2007)." UNdemocracy. N.p., n.d. Web. 14 Oct. 2013
(6) Sabar, Galia (2002). Church, State and Society in Kenya: from mediaon to opposion, 19631993. London: Frank Cass. p. 181. ISBN 0"7146"5077"3.
(7) Shopping mall is premier complex that's home to internaonal brands". Daily Naon. 21 September 2013. Web. 14 Oct. 2013
(8) McKenzie, David. "Kenyan Intelligence Warned of Al"Shabaab Threat before Mall Aack." CNN. Cable News Network, 01 Jan. 1970. Web. 14 Oct. 2013.
(9) Alexander, Guy. "Kenyan Mall Shoong: 'They Threw Grenades like Maize to Chickens'" The Guardian. N.p., 21 Sept. 2013. Web. 14 Oct. 2013.
(10) "Uhuru Kenyaa." Zimbio. N.p., 22 Sept. 2013. Web. 14 Oct. 2013.
(11) "10 Beauful PHOTOS of Westgate Mall Before It Was Destroyed " Nairobi Wire." 10 Beauful PHOTOS of Westgate Mall Before It Was Destroyed " Nairobi Wire. N.p., 25 Sept. 2013. Web. 14 Oct. 2013.
(12) Howden, Daniel. "Terror in Westgate Mall: The Full Story of the Aacks That Devastated Kenya." The Guardian. N.p., 4 Oct. 2013. Web. 14 Oct. 2013.
(13) Allen, Ron. "What Actually Happened in the Nairobi Mall Aack?" NBC News. N.p., 13 Oct. 2013. Web. 14 Oct. 2013.
(14) Buchdahl, Ellie. "'All Muslims Leave' Order... Then Gang Target Vicms Who Can't Name Prophet's Mother: Britons Caught in Crossre as Masked Gunmen Slaughter 43 in Kenyan Mall and Terrorists Blog Aack
Live on Twier." Mail Online. N.p., 21 Sept. 2013. Web. 14 Oct. 2013.
(15) Lacey"Bordeaux, Emma, and Christabelle Fombu. "Kenya Idenes Mall Aackers, including American." CNN. Cable News Network, 7 Oct. 2013. Web. 14 Oct. 2013.
(16) Odera, Argwings. "SHOCK: Police Ocer Reveals Mistakes Made By Uhurus Kitchen Cabinet In The Westgate Terror Aack." Kenya Today RSS2. N.p., 5 Oct. 2013. Web. 14 Oct. 2013.
(17) Geleman, Jerey. Ominous Signs, Then a Cruel Aack: Making Sense of Kenyas Westgate Mall Massacre. The New York Times. 27 Sept. 2013. Web 14 Oct. 2013.
(18) Zarrell, Rachel. "See A Timeline Of People Tweeng While Trapped Inside Kenyas Westgate Mall." BuzzFeed. N.p., 23 Sept. 2013. Web. 14 Oct. 2013.
(19) ABCNews. "Kenya Mall Shoong: Timeline of Events." ABC News. ABC News Network, 22 Sept. 2013. Web. 14 Oct. 2013
(20) Marnez, Michael. Kenya terror meline: Four deadly days of a store"to"store siege CNN. 24 Sept., 2013. Web. 14 Oct. 2013
(21) AP. "Kenya Ocial Says Military Caused Collapse of Westgate Mall Floors." The Guardian. N.p., 27 Sept. 2013. Web. 14 Oct. 2013.
(22) Geleman, Jerey, Nicholas Kulith and Erick Schmi. Before Kenya Aack, Rehearsals and Planng of Machine Guns. The New York Times. 24 Sept. 2013. Web 14 Oct. 2013.
(23) Associated Press. "Kenyan Troops accused of Loong Westgate Mall as Store Owners Return." NY Daily News. N.p., 2 Oct. 2013. Web. 14 Oct. 2013.
(24) "Kenya Mall Video Shows Terrorists Casually Gun down Shoppers, Chat on Cell Phones, Pray ." NY Daily News. N.p., 17 Oct. 2013. Web. 17 Oct. 2013.
(25) McKenzie, David. "Kenyan Intelligence Warned of Al"Shabaab Threat before Mall Aack." CNN. Cable News Network, 30 Sept. 2013. Web. 18 Oct. 2013.
(26) "Nairobi Siege: How the Aack Happened." BBC News. BBC, 18 Oct. 2013. Web. 18 Oct. 2013.
(27) Hartley, Will. "KDF under Fire aer Mall Siege." IHS Jane's 360. N.p., 3 Oct. 2013. Web. 12 Oct. 2013.
(28) McConnell, Tristan. "More Westgate Mall Aack Details Emerge. And They're Not Comforng." GlobalPost. N.p., 22 Oct. 2013. Web. 22 Oct. 2013.
(29) Webb, Sam, Simon Tomlinson, and Mark Duell. "Kenyan President Says Mall Siege Is OVER: Five Terrorists Dead and Bodies Trapped in the Rubble aer Three Storeys of Shopping Centre Collapse in Raid." Mail
Online. N.p., 25 Sept. 2013. Web. 21 Oct. 2013.
UNCLASSIFIED / FOR OFFICIAL USE ONLY
15

(U) Product Feedback



Customer and Product Information
Product TitIe: Westgate Attack: Lessons Learned
Dated: October 2013

Customer Agency: ________________________________________________________

ReIevance to Your InteIIigence Needs
1. Did this product increase your knowledge of an issue or topic? (Check one)

___Yes
___No


VaIue TimeIiness
2. Was this product timely to your intelligence needs? (Check one)

___Yes
___No

Content
3. Which topic of the report was most useful to you? (Check one)

___Summary of Lessons Learned
___Overview of the Westgate Attack
___Photos / Graphics

Future Reports
4. Would you like to receive more reports of this nature in the future? (Check one)

___Yes
___No


5. What changes or enhancements would you suggest for future products?

Please return this feedback form to the Kansas ntelligence Fusion Center at intelligence.fusion@ksag.org.